use read-only git protocol for submodules